Setting Up Crypto Wallets for Secure Authentication

Integrating crypto wallets into your authentication flow unlocks seamless Web3 access for users. This guide walks through Ethereum-based wallet integration using MetaMask as an example, though the principles apply to any compatible wallet.

Step 1: Retrieve the User's Ethereum Address

Begin by obtaining the user's Ethereum address through their browser. This MetaMask-compatible snippet checks for wallet availability before requesting access:

const [address] = await window.ethereum.request({ method: 'eth_requestAccounts' });

Key Considerations:

• Verify window.ethereum exists before execution
• Users must approve the connection request via MetaMask popup

Step 2: Initiate Ethereum Authentication

With the address, call Stytch's authentication endpoint to either:

• Link the wallet to an existing user (by providing user_id)
• Automatically create a new user (when omitting user_id)

Enhanced Security with SIWE:
The Sign-In With Ethereum (SIWE) protocol adds domain verification to prevent phishing. Essential parameters include:

const params = {
  crypto_wallet_address: "0x6df2dB4Fb3DA35d241901Bd53367770BF03123f1",
  crypto_wallet_type: "ethereum",
  siwe_params: {
    domain: "example.com",
    uri: "https://example.com"
  }
};

👉 Explore advanced SIWE configuration

Step 3: Message Signing Process

Users must cryptographically sign the challenge from Step 2's response:

const signature = await window.ethereum.request({
  "method": "personal_sign", 
  "params": [challenge, address]
});

Error Handling Tip: Implement UX flows for signature rejection scenarios.

Step 4: Complete the Authentication

Submit the signature for validation. Optional session controls include:

const params = {
  crypto_wallet_address: "0x6df2dB4Fb3DA35d241901Bd53367770BF03123f1",
  crypto_wallet_type: "ethereum",
  signature: "0x0c4f82edc3c818b6beff4b89e0682994e5878074609903cecdfb843241728be32f75949e2fbae63dcccdef97c0e3789a26441f7e11456cc1f2ef79b3a436010f1b"
};

Step 5: Implementation Complete!

Your Web3 authentication flow is now operational. Consider these next steps:

• Add multi-chain support
• Implement session management
• Develop recovery protocols

👉 Discover wallet integration best practices

FAQ Section

What if my users don't have MetaMask installed?

Detect absent wallets with if (!window.ethereum) and provide installation guidance or alternative auth methods.

How does SIWE improve security?

SIWE verifies the requesting domain matches the signed message, preventing malicious sites from mimicking your authentication interface.

Can I use other EVM-compatible wallets?

Absolutely! Any wallet implementing Ethereum's JSON-RPC API (like Trust Wallet or Coinbase Wallet) will work with this flow.

What happens if the signature validation fails?

Stytch returns HTTP 400 with specific error details - implement appropriate user messaging and retry mechanisms.

How long do authentication sessions last?

Default duration is configurable via session_duration_minutes parameter, typically set to 30-60 minutes for security.

Can I link multiple wallets to one user account?

Yes, simply authenticate each wallet while passing the same user_id parameter during the start phase.